CYBER THREATCAST

Apply Cisco’s remediation for CVE-2026-76519 to every Cisco Secure Email Gateway immediately, then investigate potentially affected appliances and managed Secure Email Cloud environments for compromise. Unknown attackers are already exploiting the AsyncOS zero-day to obtain unauthenticated root-level access, and CISA added it to the Known Exploited Vulnerabilities catalog with an October 17 federal remediation deadline.

Install Ivanti’s CVE-2026-104935 updates on Connect Secure appliances now, run the Integrity Checker Tool, and collect network and memory forensic evidence rather than treating a clean integrity result as conclusive. UTA0576 exploited the authentication bypass for unauthenticated command execution, credential theft, data exfiltration and reconnaissance, including against a reportedly fully patched appliance; the actor also altered logs to evade the integrity checker, and a related privilege-escalation flaw remained unpatched.

Patch LiteLLM gateways immediately, restrict configuration access, review gateway activity, and rotate potentially exposed administrator credentials and AI-provider API keys. CVE-2026-59822 and CVE-2026-59821 can reportedly be chained for unauthenticated takeover and root code execution, while separate authorization and SSRF flaws can expose files, credentials and provider keys. Malicious probing has been observed, and an internet scan found 9.6% of 3,074 assessed instances exposed.

Deploy Microsoft’s October 2026 Windows security updates, prioritizing Windows 11 and Windows 10 Extended Security Updates systems exposed to untrusted files. The update addresses about 1,400 vulnerabilities, including roughly 80 critical flaws and an actively exploited Windows Shell zero-day that bypasses Mark of the Web protections. CISA added the exploited flaw to its Known Exploited Vulnerabilities catalog and set an October 16 federal mitigation deadline.

Identify iPhones running iOS 13.0 through 17.2.1 or iOS 18.4 through 18.7 and move them to a newer supported release where available, prioritizing Ukrainian users and personnel handling cryptocurrency. Coruna contains five exploit chains with 23 exploits, while DarkSword uses a six-flaw chain against later iOS releases; the campaigns can gain kernel-level access and steal credentials, messages, location data, keychain contents and cryptocurrency-wallet information from users visiting malicious or compromised websites.